Unauthenticated role escalation via registration field injection

Improper privilege management in ProfilePress 4.13.1 and earlier allows remote attackers to register accounts with elevated roles. RegistrationAuth::register_new_user accepts an injected reg_select_role field and passes its value into user creation without restricting it to the configured form role. Public registration must be enabled and a registration form reachable; successful exploitation creates an Editor, Author, or another existing non-administrator role.